AU-C 315 (Revised), Identifying And Assessing The Risks Of .

ASB MeetingMay18-21, 2020Agenda Item 4AU-C 315 (Revised), Identifying and Assessing the Risks of Material MisstatementThrough Understanding the Entity and its EnvironmentObjective of Agenda ItemTo obtain feedback from the Auditing Standards Board (ASB) on the draft of proposedStatement on Auditing Standards (SAS), Identifying and Assessing the Risks of MaterialMisstatement Through Understanding the Entity and its Environment.Task ForceThe Task Force members are as follows: Tracy Harding–BerryDunn, ChairDora Burzenski (supported by Sally Ann Bailey)–DeloitteDiane Hardesty–EYKathy Healy–PwCSusan Jones–KPMGApril King–RSMMaria Manasses–GTDan Wernke–Clark Schaefer HackettBob Dohrer, Chief Auditor, AICPA, serves as an observer to the task force. In addition, JonHeath, ASB member, has been involved as an IT subject matter expert.BackgroundIn March 2009, the IAASB completed its Clarity Project, designed to improve the clarity andunderstandability of the International Standards on Auditing (ISAs) and International Standardon Quality Control (ISQC) 1, thereby facilitating their consistent application. One of theinitiatives in the IAASB’s Strategy and Work Program 2009–2011 was the development of aprocess for assessing the effectiveness of the implementation of the clarified ISAs.The post-implementation review of the clarified ISAs was completed in 2013, and the findingsfrom this review formed the basis for the IAASB’s Strategy and Work Plans in 2015–2019.Findings with regard to ISA 315 (Revised) (extant ISA 315) suggested that reconsideration of thestandard was needed as the comments received indicated that several aspects of the standardwere not being understood or implemented in a consistent manner. Accordingly, the Boardincluded planned work on extant ISA 315 in its Strategy and Work Plans for 2015–2019.Prepared by: Hiram Hasty (May 2020)Page 1 of 7

Risk Assessment IssuesASB Meeting, May 18-21, 2020The ISA 315 Working Group commenced work in early March 2016 and undertook outreachwith a wide group of stakeholders to further inform preliminary thinking on the issues identifiedby the ISA Implementation Monitoring Project related to ISA 315 (Revised). Auditors of smalland medium-sized entities (SMEs) noted specific challenges from a scalability perspective ineffectively and efficiently applying extant ISA 315. One of the more significant challengesrelated to the extent to which understanding an entity’s internal control is necessary when theauditor does not intend to rely on the operating effectiveness of the entity’s controls. Inspectionfindings by audit regulatory and oversight bodies consistently highlighted issues related toauditor risk assessments, including the work performed to understand internal control, identifysignificant risks and consider and respond to information technology (IT) risks. The IAASBapproved a project to revise extant ISA 315 in September 2016.In July 2018, the IAASB issued an Exposure Draft that included a proposal to revise ISA 315,Identifying and Assessing the Risks of Material Misstatements (ISA 315). The comment periodended November 2, 2018.At its meeting in September 2019, the IAASB approved the proposed ISA 315 as a finalstandard, including conforming amendments to other ISAs. The standard will be effective foraudits of financial statements for periods beginning on or after December 15, 2021.At the January 2020 meeting, the Task Force presented preliminary issues identified by the TaskForce. Significant comments or observations by the ASB members were as follows: A member expressed a concern that the proposed standard differs from the PCAOBstandard, in particular with respect to gaining an understanding of the internal controlcomponents. The proposed standard differentiates between indirect and directcomponents of internal control. Such differentiation does not exist in the PCAOBstandard. As a result of these differences, it be will be harder for auditors to navigate twosets of standards, ASB and PCAOB. Mr. Harding explained that the intent of thedistinction was to acknowledge certain components have a less direct impact on thefinancial statement risks, but still have an indirect impact, so an understanding andevaluation of the items listed under each component is important to identify and assessrisks of material misstatement. He asked that the Board focus on whether the work effortrequired in each component is clear; see further comments below. Mr. Harding explained that the Task Force proposes to make a conforming amendment toparagraph 18 of AU-C section 330 to align it more with the PCAOB standard byproposing an amendment to change paragraph 18 of AU-C section to refer to significantclass of transactions, account balance, and disclosure, instead to material class oftransactions, account balance, and disclosure. The ASB discussed the differences thatcurrently exists between paragraph 18 of AU-C section 330 and paragraph 18 of ISA 315.After discussion, the ASB was supportive of the Task Force’s proposal, but directed theTask Force to further consider making edits to paragraph 18 of AU-C section 330 tomake the requirement clearer. On the matter of variable interest entities, a member noted that content of variableinterest entities seems to be aligned with IFRS and suggested that the Task Force consultwith FinRec to make sure the content is consistent with GAAP.Agenda Item 4Page 2 of 7

Risk Assessment IssuesASB Meeting, May 18-21, 2020 With respect to the examples in the proposed standard, a member asked whether theseexamples could be relocated to the audit guide. Mr. Harding explained that the TaskForce believes that, to the extent the example is necessary to explain more fully explainedthe application material, it should be retained in the proposed standard. After discussion,the ASB decided to keep the examples in the proposed SAS, but the examples could befurther explained in the audit guide. Mr. Harding led a review of the proposed standard. The following were the significantmatters discussed by the ASB:o Gaining an understanding of the components of internal control—for each of thecomponents of internal control, the auditor will be required to gain anunderstanding of certain matters related to each component of internal control andevaluate certain aspects of the controls within each component. A memberexpressed concern about the term “evaluate.” He explained that as articulated, theterm “evaluate” seems to convey that the auditor would have to performprocedures similar to the procedures that the auditor would be required to evaluatedesign and implementation of controls (D&I procedures). Mr. Harding explainedthat paragraph 26d contains the explicit requirement for the auditor to performD&I procedures, which relates to the control activities component, and that theproposed SAS explains that the control activities component includes controls thatare designed to ensure the proper application of policies (which are also controls)in all the other components. A member expressed caution about changing theterminology in the requirement but suggested that the Task Force consider addingapplication material to better explain the work effort required in gaining anunderstanding of the components of internal control and performing the requiredevaluation, including D&I procedures when required.o Paragraph A109a explains that in obtaining an understanding of the entity’s riskassessment process, AU-C section 240 also requires the auditor to make inquiriesof management regarding, among other things, management’s process foridentifying, responding to, and monitoring the risks of fraud in the entity,including any specific risks of fraud that management has identified or that havebeen brought to its attention, or classes of transactions, account balances, ordisclosures for which a risk of fraud is likely to exist. A member asked thequestion whether this guidance suggests that the auditor would be required toobtain an understanding of controls and perform D&I procedures on controlswithin the entity’s risk assessment process (similar issue as discussed above).o Mr. Harding highlighted that paragraph 25c has been edited by the Task Force toexplicitly note that the auditor’s evaluation of the information and communicationcomponent is based on the understanding in sub-paragraphs 25a-b. A memberexpressed concern about this edit, because the auditor’s understanding of theinformation and communication component may not necessarily be limited to theunderstanding required under sub-paragraphs 25a-b. The ASB directed the TaskForce to further consider this comment.o A member raised the issue whether the Task Force considered the requirement inextant AU-C section 315 that requires the auditor to obtain an understanding ofAgenda Item 4Page 3 of 7

Risk Assessment IssuesASB Meeting, May 18-21, 2020the process of reconciling detailed records to the general ledger for materialaccount balances. Mr. Harding explained that it was the Task Force’s view thatthis requirement is addressed in paragraph 25. The Task Force was directed tokeep this requirement as a sub-paragraph to paragraph 26.o A member recommended the Task Force consider language to clarify the“controls over journal entries” referenced in paragraph 26a(ii), as many entitiesuse journal entries to record routine transactions such as revenue and expenses.The Task Force will explore language that distinguishes processing of routinetransactions from other adjustments to accounting records used to preparefinancial statements.o Mr. Harding requested feedback about the “catchall” category of controls in thecontrol activities component described in paragraph 26a(iv). A membersuggested the Task Force include application material referencing estimates as apotential example of an area that may involve such controls, in a mannerconsistent with guidance in the Estimates ED.Matters for the ASB’s ConsiderationGaining an Understanding of the Components of Internal Control – Work EffortUnder the proposed SAS, the auditor will be required to gain an understanding of certain mattersrelated to each component of internal control and evaluate certain aspects of the controls withineach component (see paragraphs 21 – 26). At the January meeting, a member expressed concernabout the term “evaluate” used in this context because the work effort in gaining an understandingof the components of internal control seems indistinguishable from the work effort required toevaluate design and implementation of controls (see paragraph 26d of the proposed SAS).The Task Force revisited this issue. Members of the Task Force who participated in the ISA 315project expressed the view that the evaluation required for the control environment, the entity’srisk assessment process, and the entity’s process for monitoring the system of internal control wasnot intended to require the auditor to perform D&I procedures. Rather, the requirements in eachof those components of internal control outline the work effort that the auditor would be requiredto perform in order to gain an understanding of those components. Paragraph A104 explains thiswork effort as it relates to the control environment component:A104. The auditor’s evaluation of the control environment is based on the understandingobtained in accordance with paragraph 21(a).Each of the other components has the same explanation.At the January ASB meeting, the Board discussed moving the condition set forth in paragraphA104 to the related requirement (paragraph 21). Upon further deliberations, the Task Forcesuggests keeping this condition in the application material, because some Task Force membersbelieved that to include it in the requirement might be read as prohibiting the auditor fromconsidering other information and thus could be viewed as a difference from the ISA requirements.Agenda Item 4Page 4 of 7